Fileless Linux rootkit hides PHP web shell in memory on F5 BIG-IP APM appliances via exploited CVE-2025-53521

Sophos and ESET detailed a fileless Linux rootkit (Linux/Agnt-IC, dubbed PoisonedRefresh) that injects a memory-resident PHP web shell into Apache on compromised F5 BIG-IP APM devices, leaving on-disk files clean and linked to in-the-wild exploitation of…

A stealthy Linux rootkit implant analyzed by Sophos (with related analysis from ESET, who dubbed it PoisonedRefresh) has been found on compromised F5 BIG-IP Access Policy Manager appliances, which serve enterprise, financial, government, and public sector deployments as federated SSO identity gateways and TLS termination points. Initial access leverages CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM that triggers when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, and the flaw is rated CVSS 3.1 9.8, was patched in October 2025, and was added to CISA's KEV list on March 27, 2026. Shadowserver observed 795 internet-exposed endpoints vulnerable to the flaw at disclosure. A first-stage installer hidden in a modified umount binary infects /usr/sbin/httpd before Apache starts, disables or modifies SELinux configuration, and embeds itself in BIG-IP upgrade images for persistence across upgrades. The second-stage ELF intercepts __libc_start_main, hooks Apache's APR module loader (apr_dso_load), and modifies the libphp PHP module in memory so that when Apache loads three legitimate webtop scripts (apm_css.php3, full_wt.php3, webtop_popup_css.php3), an in-memory web shell is served while the on-disk files remain untouched, meaning hashes match and file-integrity monitoring passes. The web shell reads php://input, decrypts RC4-encrypted commands, and replies with HTTP 201 and a text/css content type to blend with normal traffic; the implant also exposes an interactive /bin/bash shell via an authenticated local UNIX domain socket at /run/bigtlog.pipe, avoiding TCP ports and network-based detection. Sophos published detection leads including .php3 requests, HTTP 201 responses on CSS endpoints, /proc/self/maps reads, and file, log, traffic, and SHA-256 indicators. Reports disagree on the Sophos publication date, citing September 7 versus September 8, 2026. Experts warn that compromised APM appliances could leak SSO tokens and credentials and enable lateral movement to trusted downstream applications.

• Malware is a fileless Linux rootkit tracked as Linux/Agnt-IC, named PoisonedRefresh by ESET, targeting F5 BIG-IP APM appliances running Apache and PHP.
• Initial access is via CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; rated CVSS 3.1 9.8, patched October 2025, added to CISA KEV on March 27, 2026, and exploited in the wild.
• F5 links the activity to cluster c05d5254; Shadowserver observed 795 internet-exposed endpoints vulnerable to CVE-2025-53521 at disclosure.
• First-stage installer hides in a modified umount binary, infects /usr/sbin/httpd before Apache starts, disables/modifies SELinux configuration, and embeds itself in BIG-IP upgrade images for persistence.
• Second stage intercepts __libc_start_main, hooks apr_dso_load, and modifies the libphp module in memory to inject a PHP web shell into three legitimate scripts: apm_css.php3, full_wt.php3, and webtop_popup_css.php3.
• On-disk files remain unchanged, so hashes match and file-integrity monitoring and disk scans pass while the system is compromised.
• Web shell reads php://input, decrypts RC4-encrypted commands, and replies with HTTP 201 and text/css content type; key strings are RC4-encoded.
• An authenticated local UNIX domain socket at /run/bigtlog.pipe provides an interactive /bin/bash session without opening TCP ports.